azure-federated-identity-samples

Access AKS cluster using Azure Federated Identity from Github Actions (OpenID Connect)

Inspired by a community contribution in (Azure/kubelogin#81), it enables a new pattern to access AKS clusters from Github. Instead of creating credential for a service principal and storing it in Github, it utilizes Github's OpenID Connect and Azure Workload Identity Federation to access AKS clusters using AAD/Azure RBAC in a password-free setting.

Environment setup

In setup.sh, these steps are performed:

1. Create an AKS cluster with Azure RBAC enabled.
2. Create AAD application and service principal.
3. Create role assignment to the created AKS cluster using Azure Kubernetes Service RBAC Cluster Admin role.
4. Create federated identity credential using Microsoft Graph api. Note that audience has to be api://AzureADTokenExchange and the format of subject claim.

Github Actions

The sample Github Actions workflow, access-aks.yml, has prerequisites such that below Actions secrets need to be configured:

• AZURE_SUBSCRIPTION_ID is the subscription ID in which AKS cluster resides
• RESOURCE_GROUP_NAME is the resource group in which AKS cluster resides
• AKS_NAME is the AKS cluster name used in Environment setup
• AZURE_TENANT_ID is Azure AD tenant ID
• AZURE_CLIENT_ID is the appID created in Environment setup

This workflow performs these steps:

1. Az login using workload identity federation
2. Get kubeconfig
3. Get kubelogin
4. Convert kubeconfig into exec plugin format with workload identity support
5. Get id-token and save to a file
6. Run kubectl
7. Profit!